by Kastro
Paper/Archive/CVE-2026-17032

CVE-2026-17032

Unknown google-maps-easy-pro — Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.8.458 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

Affected

ProductAffectedFixed inSource
google-maps-easy-pro1.6.9 – < 1.7.01.7.0CNA
supsystic-gallery-pro2.10.9 – < 2.11.12.11.1CNA
tables-generator-pro1.9.20 – < 1.10.11.10.1CNA

Scores by source

WPScan (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/7ca5ad30-1792-4014-bfad-88911cd64713